Isolation-clean frontend: delete dead JS, guard listeners, leave shared DOM

- Delete 7 dead-squat widgets (registered UI only for other packs' nodes:
  UniRig/SAM3D/Mocap/FBXPreview/BVH/pointcloud) + their 6 orphaned viewer
  HTMLs + the entire unused js/viewer tree (21 files, imported by nothing;
  only ui/styles.css survives) + unused utils barrel.
- Rename namespace geompack -> geometrypack (= DisplayName, lowercased);
  all 17 surviving extensions now geometrypack.*.
- Add event.source provenance guards to every message listener (2 inline,
  2 factory handlers via new iframe param).
- Stop touching document.body: upload file input stays detached (click()
  works detached in modern browsers); folder autocomplete dropdown becomes
  a manual popover inside the widget's own DOM (top layer escapes canvas
  transforms without shared-DOM appends).

Passes comfy-test's javascript isolation lint with 0 errors.

javascript/js/preview_mesh_multi_batch.js

@@ -15,7 +15,7 @@ const EXTENSION_FOLDER = (() => {
 console.log('[GeomPack Multi Batch JS] Loading preview_mesh_multi_batch.js extension');
 
 app.registerExtension({
-    name: "geompack.meshpreview.multibatch",
+    name: "geometrypack.meshpreview.multibatch",
 
     async beforeRegisterNodeDef(nodeType, nodeData, app) {
         if (nodeData.name === "GeomPackPreviewMeshMultiBatch") {